space_server: chrony: run chrony ntp server

7 files changed, 99 insertions, 5 deletions

diff --git a/roles/space_server/files/chrony.conf b/roles/space_server/files/chrony.conf
new file mode 100644
index 0000000..a33bd23
--- /dev/null
+++ b/roles/space_server/files/chrony.conf
@@ -0,0 +1,56 @@
+# Set upstream servers
+#server mmo1.ntp.se iburst
+#server mmo2.ntp.se iburst
+server nts.ntp.se iburst nts
+server time.cloudflare.com iburst nts
+
+# Specify file containing keys for NTP authentication
+keyfile /etc/chrony.keys
+
+# Dump measurement history here
+dumpdir /var/lib/chrony
+
+# Dump NTS cookies here
+ntsdumpdir /var/lib/chrony
+
+# Record the rate at which the system clock gains/losses time
+driftfile /var/lib/chrony/drift
+
+# Use /etc/adjtime
+hwclockfile /etc/adjtime
+
+# Make requests from space.labitat.dk public addresses
+bindacqaddress 185.38.175.0
+bindacqaddress 2a01:4262:1ab::
+
+# Listen to NTP on space.labitat.dk public addresses
+bindaddress 185.38.175.0
+bindaddress 2a01:4262:1ab::
+
+# Allow NTP access only from local network
+deny all
+allow 185.38.175.0/24
+allow 10.42.0.0/16
+allow 2a01:4262:1ab::/48
+
+# Allow the system clock to be stepped in the first three updates
+# if its offset is larger than 1 second.
+makestep 1.0 3
+
+# Enable kernel synchronization of the real-time clock (RTC).
+rtcsync
+
+# Enable hardware timestamping on wan
+hwtimestamp wan
+
+# Let the kernel handle leap seconds
+leapsecmode system
+
+# Get TAI-UTC offset and leap seconds from the system tz database
+leapsectz right/UTC
+
+# Specify directory for log files
+#logdir /var/log/chrony
+
+# Select which information is logged
+#log measurements statistics tracking
diff --git a/roles/space_server/files/nftables.conf b/roles/space_server/files/nftables.conf
index a0c17c1..066c03e 100644
--- a/roles/space_server/files/nftables.conf
+++ b/roles/space_server/files/nftables.conf
@@ -96,6 +96,9 @@ table ip filter {
 		tcp dport 53 ip saddr { $int_net4, $ext_net4 } accept
 		udp dport 53 ip saddr { $int_net4, $ext_net4 } accept
 
+		# ntp
+		udp dport 123 ip saddr { $int_net4, $ext_net4 } accept
+
 		# avahi
 		ip daddr 224.0.0.251 udp dport 5353 iif $avahi_ifs accept
 		ip protocol igmp iif $avahi_ifs accept
@@ -173,6 +176,9 @@ table ip6 filter {
 		tcp dport 53 ip6 saddr $ext_net6 accept
 		udp dport 53 ip6 saddr $ext_net6 accept
 
+		# ntp
+		udp dport 123 ip6 saddr $ext_net6 accept
+
 		# avahi
 		ip6 daddr ff02::fb udp dport 5353 iif $avahi_ifs accept
 
diff --git a/roles/space_server/handlers/main.yml b/roles/space_server/handlers/main.yml
index adf4ee9..94c48b5 100644
--- a/roles/space_server/handlers/main.yml
+++ b/roles/space_server/handlers/main.yml
@@ -5,6 +5,12 @@
     state: reloaded
   when: not chroot
 
+- name: restart chronyd
+  systemd:
+    name: chronyd.service
+    state: restarted
+  when: not chroot
+
 - name: restart bird
   systemd:
     name: bird.service
diff --git a/roles/space_server/tasks/chrony.yml b/roles/space_server/tasks/chrony.yml
new file mode 100644
index 0000000..2777591
--- /dev/null
+++ b/roles/space_server/tasks/chrony.yml
@@ -0,0 +1,22 @@
+---
+- name: Configure chrony.conf
+  copy:
+    dest: '/etc/chrony.conf'
+    src: chrony.conf
+    owner: root
+    group: root
+    mode: 0644
+  notify: restart chronyd
+
+- name: Enable chronyd service
+  systemd:
+    name: chronyd.service
+    enabled: yes
+    masked: no
+    state: started
+  when: not chroot
+- name: '- when in chroot'
+  command: systemctl enable chronyd.service
+  when: chroot
+
+# vim: set ts=2 sw=2 et ft=yaml:
diff --git a/roles/space_server/tasks/main.yml b/roles/space_server/tasks/main.yml
index f4f89d6..112c4ce 100644
--- a/roles/space_server/tasks/main.yml
+++ b/roles/space_server/tasks/main.yml
@@ -17,6 +17,8 @@
   tags: networkd
 - import_tasks: nftables.yml
   tags: nftables
+- import_tasks: chrony.yml
+  tags: chrony
 - import_tasks: bird.yml
   tags: bird
 - import_tasks: dhcpd.yml
diff --git a/roles/space_server/templates/dhcpd.conf.j2 b/roles/space_server/templates/dhcpd.conf.j2
index dbfa2b7..a2d82a7 100644
--- a/roles/space_server/templates/dhcpd.conf.j2
+++ b/roles/space_server/templates/dhcpd.conf.j2
@@ -58,7 +58,7 @@ subnet 10.42.0.0 netmask 255.255.255.0 {
 	range 10.42.0.50 10.42.0.250;
 	option routers 10.42.0.1;
 	option domain-name-servers 185.38.175.0;
-	#option ntp-servers 90.185.0.18;
+	option ntp-servers 185.38.175.0;
 	ddns-updates off;
 
 	deny bootp;
@@ -73,7 +73,7 @@ subnet 10.42.1.0 netmask 255.255.255.0 {
 	range dynamic-bootp 10.42.1.50 10.42.1.250;
 	option routers 10.42.1.1;
 	option domain-name-servers 185.38.175.0;
-	#option ntp-servers 90.185.0.18;
+	option ntp-servers 185.38.175.0;
 	next-server 10.42.1.1;
 	filename "pxelinux.0";
 
@@ -96,7 +96,7 @@ subnet 10.42.2.0 netmask 255.255.255.0 {
 	range dynamic-bootp 10.42.2.50 10.42.2.250;
 	option routers 10.42.2.1;
 	option domain-name-servers 185.38.175.0;
-	#option ntp-servers 90.185.0.18;
+	option ntp-servers 185.38.175.0;
 	next-server 10.42.2.1;
 	filename "pxelinux.0";
 
@@ -119,7 +119,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 {
 	range dynamic-bootp 10.42.3.50 10.42.3.250;
 	option routers 10.42.3.1;
 	option domain-name-servers 185.38.175.0;
-	#option ntp-servers 90.185.0.18;
+	option ntp-servers 185.38.175.0;
 
 	if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" {
 		ddns-hostname = option host-name;
@@ -140,7 +140,7 @@ subnet 10.42.3.0 netmask 255.255.255.0 {
 #	range dynamic-bootp 10.42.4.50 10.42.4.250;
 #	option routers 10.42.4.1;
 #	option domain-name-servers 185.38.175.0;
-#	#option ntp-servers 90.185.0.18;
+#	option ntp-servers 185.38.175.0;
 #
 #	if exists host-name and option host-name ~= "^[0-9A-Za-z-]*$" {
 #		ddns-hostname = option host-name;
diff --git a/roles/space_server/vars/main.yml b/roles/space_server/vars/main.yml
index 6cd4e38..76eff66 100644
--- a/roles/space_server/vars/main.yml
+++ b/roles/space_server/vars/main.yml
@@ -2,6 +2,7 @@
 hostname: 'space'
 
 use_resolved: false
+use_timesyncd: false
 
 locale_default:
   LANG: 'da_DK.UTF-8'
@@ -26,6 +27,7 @@ dnf_packages_role:
   'systemd-networkd': present
   'systemd-container': present
   'sudo': present
+  'chrony': present
   'nftables': present
   'openssh-server': present
   'openssh-clients': present